My question is: How exactly should I understand the ESTABLISHED state in UDP? UDP is stateless.

Here is my intuition - I'd like to know, if or where this is incorrect:

The man page tells me this:

state

This module, when combined with connection tracking, allows access to the
connection tracking state for this packet.
--state ...

So, iptables basically remembers the port number that was used for the outgoing packet (what else could it remember for a UDP packet?), and then allows the first incoming packet that is sent back within a short timeframe? An attacker would have to guess the port number (would that really be too hard?)

About avoiding conflicts:

The kernel keeps track of which ports are blocked (either by other services, or by previous outgoing UDP packets), so that these ports will not be used for new outgoing DNS packets within the timeframe? (What would happen, if I accidentally tried to start a service on that port within the timeframe - would that attempt be denied/blocked?)

2 Answers
2

So, iptables basically remembers the
port number that was used for the
outgoing packet (what else could it
remember for a UDP packet?),

I am pretty sure for UDP the source and destination ports and addresses are stored.

If you want to inspect the state tables install conntrack and/or netstat-nat.

(What would happen, if I accidentally
tried to start a service on that port
within the timeframe - would that
attempt be denied/blocked?)

Since you are using OUTPUT and INPUT your are talking about local services. The port is already used I don't believe your system will allow you to start up another service since something is already listening on that port. I guess you could stop the first service and start another if you really wanted to though, in that case the response would probably get to your service. What the service does with the packet depends on what the contents of the packet is, and what service it is.

So if I started say a Tomcat instance on port 8080, I'll have a 1:(65535-1023) chance that the startup will fail, if accidentally a DNS query is running on the same port? Or will it just wait until the timeframe expired? How long is the timeframe by default?
–
Chris LercherMar 17 '10 at 0:14

1

On Linux I believe the ephemeral port range is commonly 32768-61000 (see /proc/sys/net/ipv4/ip_local_port_range) this wouldn't include your example port of 8080. It tends to be very uncommon to setup services to listen on ports within the ephemeral range. The time a UDP entry states in the table is typically 30 seconds (see /proc/sys/net/netfilter/nf_conntrack_udp_timeout)
–
ZoredacheMar 17 '10 at 1:08

Despite what the man pages say, ESTABLISHED appears to mean "stateful". For UDP that simply means (as you suggest) remembering each outbound UDP packet (the "src ip, src port dst ip, dst port" tuple) for a while and recognising its responses.

I'm aware that I should allow TCP, too. But what would RELATED mean for UDP? Manpage: "RELATED meaning that the packet is starting a new connection, but is associated with an existing connection, ..." Connections for UDP? Maybe it really makes more sense than ESTABLISHED, but that's what I'd like to find out.
–
Chris LercherMar 17 '10 at 11:46

When I use your rules, but restrict udp INPUT to RELATED, my DNS queries don't work. Seems that I have to allow ESTABLISHED. Is there any reason to also allow RELATED (for UDP)?
–
Chris LercherMar 17 '10 at 12:39

ok, it seems that ESTABLISHED means more than the man page says. In any event, if you use OUTPUT filters like mine and don't accept inbonud traffic then that INPUT rule is the only one you'll ever need.
–
AlnitakMar 17 '10 at 13:47

Yeah, the man page is really unclear about these things. But as long as I don't know, if there's any way for an attacker to create a RELATED udp packet (if anything like that exists?) more easily than an ESTABLISHED one, I'd rather be careful with allowing that. My guess is, that RELATED udp packets simply don't exist - in which case your rules are absolutely ok. But I'm not sure.
–
Chris LercherMar 17 '10 at 13:59

1

Given what we've found, RELATED udp packets don't exist AFAIK. However (for example) if you ever do outbound FTP from that box you need a RELATED state rule for the data channel. The single "ESTABLISHED,RELATED" rule is AFAIK the most optimal single rule for ingress traffic.
–
AlnitakMar 17 '10 at 14:03